A cryptographic hash function maps any input to a fixed-size digest. It is one-way by design, so the digest cannot be reversed to the input, and it is collision-resistant, so finding two inputs with the same digest is impractical for SHA-2. A checksum uses similar arithmetic but deliberately none of those properties.
01Digests, MACs and checksums
A digest (SHA-256, SHA-512) detects any change to the bytes and underpins signatures and content addressing.
An HMAC mixes a shared secret into a digest, so only a key holder can produce a matching value; it authenticates as well as detects change.
A checksum (CRC-32, Adler-32, FNV-1a) is fast and catches accidental corruption, but it is easy to forge and is not a security control.
02What a digest does not do
A digest is not encryption and provides no confidentiality. A bare digest is also not a password hash: password storage needs a salt and a deliberately slow key-derivation function such as Argon2, scrypt or bcrypt, because a fast hash lets an attacker test guesses cheaply.
Frequently asked questions
Is a hash the same as encryption?
No. Encryption is reversible with a key; a hash is a one-way fixed-size digest and cannot be decrypted.
When should I use HMAC instead of a plain hash?
Use HMAC when two parties share a secret and must prove a message was not altered by anyone without the key, such as a webhook signature.
A practical guide to choosing random passwords and tokens, deriving and storing password hashes, signing tokens, encrypting with authenticated modes and measuring entropy.